CVE-2024-47880

What it actually does

Reflected XSS in the export-rows command that echoes request content verbatim into the HTTP response along with an attacker-supplied Content-Type header, allowing script execution in the victim's browser session with the privileges of the authenticated OpenRefine user.

Why it matters to the business

Attackers can cause data loss, exfiltrate project contents or credentials, and run arbitrary expressions if Jython or Closure extensions are enabled, interrupting data-cleaning operations and exposing sensitive information stored in projects.

How an attack unfolds

An attacker creates a malicious web page that performs a cross-origin form POST to the victim's OpenRefine instance using a known valid project ID; the payload contains embedded JavaScript and a forged Content-Type header; when the authenticated user visits the page the response is rendered as executable script, enabling actions such as project deletion or expression execution.

How to fix it

Upgrade OpenRefine to version 3.8.3 or later; the GIT repository is fixed at commit d70d9114a8c021a233f0c13c73a0a7784276f2a4. Apply the same patch to any forked or embedded deployments.

How to confirm the fix worked

Confirm the installed version is 3.8.3 or newer; re-test the export-rows endpoint with a benign payload containing a script tag and verify that the response no longer reflects the payload with an attacker-controlled Content-Type.

Typical attack path

1. Identify a reachable OpenRefine instance and obtain a valid project ID containing at least one row
2. Host a malicious page that submits a crafted POST to the export-rows endpoint
3. Include attacker-controlled JavaScript and Content-Type header in the request body
4. Social-engineer an authenticated user to visit the malicious page
5. Execute arbitrary actions within the victim's OpenRefine session

How to detect it

Review web-server access logs for POST requests to export-rows endpoints that contain script tags, javascript: URIs, or unusual Content-Type values; correlate with subsequent actions such as project deletion or expression execution.

• POST.*export-rows
• Content-Type:.*text/html.*script
• embedded JavaScript in export-rows response

What your security team should do

• Immediately upgrade all OpenRefine instances to 3.8.3
• Audit project IDs exposed to untrusted users and restrict access where possible
• Disable Jython and Closure extensions if not required
• Monitor web logs for unexpected POSTs to export-rows containing script-like content